Phillip Büchler

More bugs, found faster # In 2025, 48,185 CVEs were published, about 21% more than in 2024. That’s roughly 130 a day, with a clear preference for Tuesdays. Not all of them are your problem. The biggest single source was a company that reports WordPress plugin bugs, and I’m fairly sure nobody runs WordPress on their CEO’s laptop.1 The direction matters more than the number, and AI is pushing it from both ends. Google’s Big Sleep agent reported its first 20 vulnerabilities in August 2025, mostly in FFmpeg and ImageMagick. Those aren’t exotic projects. They sit inside a lot of desktop software your users run every day. On the other end, Mandiant’s M-Trends 2026 estimates the mean time to exploit at minus seven days. On average, exploitation now starts before the patch exists. And according to the Verizon 2026 DBIR, organisations took a median of 43 days to fix vulnerabilities, up from 32 the year before.

The gorilla debate never ended. Nobody won it. People just got bored and moved on to the next question. In the first post of this series I argued that this is a problem with taking a question apart. It has no natural end. You can always split it once more. In the second I looked at the people who go first into the unknown, and ended on an uncomfortable observation: they often don’t come back out.

In the last post I took apart a silly internet question: could 100 unarmed men beat one gorilla? Most serious answers agreed the men win eventually, if they accept heavy losses. One sub-question stayed with me. Who goes first? The man who started the debate gave the most honest answer. He would join the 100, just not the first wave. Most of us would say the same. So the first wave is made of volunteers, and probably the bravest ones. Here is the paradox. It takes brave people to go first. It also takes brave people to keep going after watching the first wave go down. If the bravest all go first, who is left for the rest of the fight?

I was walking my dog the other day and asked myself how I would explain critical thinking to students. Not the textbook version. The version where you take a question apart and find out it was never one question. My dog had no opinion on the matter. The example I landed on is a bit embarrassing: 100 men against a gorilla. If you missed it, the question started as a Reddit thread in 2020 and went properly viral in late April 2025. Could 100 unarmed men beat one silverback? TikTok argued, zoo directors gave interviews, and at least one US senator shared his view on the record.1

I just went through the slides of an old Gartner keynote about the digital workplace. “Old” is a big word here, since it is from 2024, but in technology terms that is already close to retirement age. I did not attend the talk, and the slides are graphically simple. So this is my interpretation of the slides, not a summary of what was said on stage. One slide stood out. It lists what leaders should take away: see the danger of only dealing with the problems in front of you, and support the ambitions for AI and distributed work. Other slides talk about everyday AI, productivity gains and new ways of working.